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ABSTRACT 

A prologue and an epilogue of a function are hooked. 
5 Completion of the prologue is stalled in a first state of a 
stack frame, and a copy of the first state of the stack frame 
is saved. Completion of the prologue is initiated, 
permitting execution of the function. Completion of the 
epilogue is stalled in a second state of the stack frame. 

10 The saved copy of the first state of the stack frame is 
located and compared with the second state of the stack 
frame. A determination is made whether the stack frame is 
corrupted based on the comparison. Upon a determination that 
the stack frame is corrupted, the second state of the stack 

15 frame is replaced with the copy of the first state of the 
stack frame, and completion of the epilogue, is initiated, 
allowing the function to complete. 
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